Dongtai-agent-java is DongTai Iast's data acquisition tool for Java applications. In a Java application with the iast agent added, the required data is collected by rewriting class bytecode, and then the data is sent to dongtai-OpenAPI service, and then the cloud engine processes the data to determine whether there are security holes.
Dongtai-agent-java consists of
iast-inject. Jar and
agent.jarIt is used to manage agent life cycle and configuration. The life cycle of the Agent includes downloading, installing, starting, stopping, restarting, and uninstalling the agent. Agent configuration includes application startup mode, vulnerability verification mode, whether to enable agent, etc.
iast-core.jarThe main functions of iast-core.jar are: bytecode piling, data collection, data preprocessing, data reporting, third-party component management, etc.
iast-inject.jarIt is used to inject into the BootStrap ClassLoader. The data collection method in 'iast-core.jar' is then invoked in the target application.
dongtai-servlet.jarIt is used to obtain the requests sent by the application and the responses received. It is used for data display and request replay.
- Security test the application before it goes online
- Third-party Component Management
- Code audit
- 0 Day digging
Please refer to the Quick Start.
Fork the DongTai-agent-java , clone your fork:
git clone https://github.com/<your-username>/DongTai-agent-java
Write code to your needs.
Compile Dongtai-agent-Java using Maven:
mvn clean package -Dmaven.test.skip=true
- notice: JDK version is 1.8.
./releaseis generated in the project root directory after compilation:
release ├── iast-agent.jar └── lib ├── dongtai-servlet.jar ├── iast-core.jar └── iast-inject.jar
dongtai-servlet.jarto the system temporary directory. Get the system temporary directory to run the following Java code:
Run the application and test the code (for example, SpringBoot) :
java -javaagent:/path/to/iast-agent.jar -Ddebug=true -jar app.jar
Contribute code. If you want to contribute code to the DongTai IAST team, please read the full contribution guide.
Supported Java versions and middleware
- Java 1.6+
- Tomcat, Jetty, WebLogic, WebSphere, SpringBoot and Mainstream software and middleware.